When it comes to the digitalization of the economy, growth forecasts are now coming thick and fast. According to leading economic experts, German industry has untapped value creation potential in the three-digit billion range. A study conducted by the Bitkom association in 2014, for example, estimates that Industry 4.0 could generate additional added value of around 50 billion euros by 2025 in the automotive, mechanical engineering and electronics manufacturing sectors alone.

However, the need for action does not yet exist to the same extent in all sectors of the economy. Industry, and high-tech manufacturing in particular, is already facing enormous pressure to digitize. Ever shorter product cycles and increasing competitive pressure are making the digital factory one of the decisive factors for the future, if only because of its high optimization potential for increasingly complex supply chains. Especially as the production process of an aircraft, car or smartphone no longer consists of a single supply chain, but rather the sum of hundreds of interlinked, coordinated value creation processes and production steps. Under these circumstances, abandoning Industry 4.0 would mean giving up hard-earned technological advantages and thus slowly but surely losing market relevance.

Even if every technology manufacturer has to develop and implement its own unique strategies as part of the digital transformation, all smart industry concepts ultimately share a common paradigm: the production of the future is data-driven, networked and transparent. The production process, material flow and ERP information are merging, while the number of real-time data streams and connections is growing exponentially - and with it the number of potential security gaps. It is already clear that "classic" security concepts, which are mainly based on the separation of production systems and office IT, will no longer be able to meet the challenges of the digital factory. A digital transformation strategy must therefore also include the prerequisites for the secure operation of new technologies, in which the boundaries between the IT level and production systems are increasingly disappearing. The technological realignment offers an ideal starting point for a fundamental security assessment and the evaluation of potential security risks, particularly with regard to planning one's own digital agenda.

Security problem due to established structures

Even though industrial digitalization is often portrayed as a revolution, it is actually a continuous process that began back in the 1980s and 1990s. When modern automation technology began, the Internet was still in its infancy. At the time, nobody seriously considered the possibility of connecting production systems to the Internet. Industrial control systems were regarded as isolated units - security functions such as authentication mechanisms, password management or access restrictions were therefore not necessary and simply not provided for at protocol level. It was sufficient for a production subsystem to be connected to a higher hierarchy such as a PLC system via a two-wire line or radio, as practical advantages such as real-time capability and reliability were the decisive parameters in the production network.

However, despite the high real-time requirements, the age of the Internet has not left the production level unscathed. Where the flexibility of TCP/IP was of benefit or costs could be saved, many connections have been converted to the IP protocol in recent years - but not always with the necessary systematic approach and only rarely with the corresponding IT security awareness.

One of the main drivers was the provision of remote access. Technicians and maintenance personnel from plant manufacturers needed to be able to access the management interfaces of production systems quickly in order to make configuration changes, view the status of machines or install important updates - without incurring high labor or travel costs. This resulted in organically grown networking structures with a heterogeneous architecture of industry-specific protocols, local network nodes with a connection to the office IT and more or less open Internet access - mostly poorly documented, insufficiently segmented and, due to a lack of available guidelines, without uniform standards for access management and password security.

From silo thinking to interdisciplinary consensus

For production specialists and automation engineers, the mix-and-match state of many industrial networks may not initially raise any concerns. After all, functions that could jeopardize the operational safety of systems are executed separately at field level and designed redundantly. Safety-relevant limit values such as maximum pressures or pump speeds are hard-coded anyway. In addition, the industry-specific protocols used represent a major technical hurdle for potential attackers. However, in view of developments in recent years, these aspects alone are no longer sufficient. Not only has the number of IP connections increased significantly, but the threat situation itself is completely different today than it was five years ago. At the latest since the emergence of Stuxnet and other malware variants specializing in industrial networks, the discussion about security in production systems has become increasingly public. In addition, there are now also specialized search engines that can specifically search for open Internet connections with production-specific protocols.